In Google Analytics a user is considered a unique visitor to the website. When you visit a website with Google Analytics tracking, it stores a user id in a browser cookie. The next time you come to the site it reads your id and knows you’re a returning user. Due to the nature of cookie based tracking, new vs returning users is only an estimate. If a user clears their cookies or is browsing in a private mode, then every time they return to the site they are considered a new user.
In order to count a returning user several circumstances are required. First the user must not have cleared their browser cookies. Second they must have passed the session timeout before returning. If they cleared their cookies, then they will immediately be counted as a new user regardless of when they visited. If they did not remove their cookies and have not passed the session timeout, then the user will not be counted.
Since user tracking relies on an easily subverted tracking it is important to understand the data is an estimate. Lets say your site was visited primarily by privacy enthusiasts. Then your data would show a large number of new users when the truth is there are a large number of returning users.
You can view more information related to sessions here.